@anonympins/fingerprint 0.2.3 → 0.3.0

package/fingerprint.js

@@ -1,7 +1,7 @@
 import crypto from "node:crypto";
 import { BlockList } from "node:net";
 import dns from "node:dns/promises";
-import { problemManager } from "./problem-manager.js";
+import { getProblemManager, problemManager } from "./problem-manager.js";
 import { Optimization } from "./library.js";
 import { cyrb53, FingerprintBuilder } from "./fingerprint.builder.js";
 import { readFileSync } from "node:fs";
@@ -47,7 +47,8 @@ const securityProfiles = {
             behaviorScore: 0.7,
             honeypotScore: 1.0,
             crossLayerInconsistencyScore: 0.4,
-            timeInconsistencyScore: 0.9
+            timeInconsistencyScore: 0.9,
+            tlsSpoofingScore: 0.8 // NOUVEAU: Poids pour la détection de spoofing TLS
         },
         thresholds: { low: 20, medium: 45, high: 75, block: 95 },
         patterns: {
@@ -77,7 +78,8 @@ const securityProfiles = {
             behaviorScore: 0.8,
             honeypotScore: 1.0,
             crossLayerInconsistencyScore: 0.6,
-            timeInconsistencyScore: 1.0
+            timeInconsistencyScore: 1.0,
+            tlsSpoofingScore: 1.0 // NOUVEAU: Plus agressif pour le spoofing TLS
         },
         thresholds: { low: 10, medium: 35, high: 65, block: 90 },
         patterns: {
@@ -108,7 +110,8 @@ const securityProfiles = {
             behaviorScore: 0.2, // Lower weight, as browser behavior is not applicable
             honeypotScore: 1.0,
             crossLayerInconsistencyScore: 0.5,
-            timeInconsistencyScore: 0.8
+            timeInconsistencyScore: 0.8,
+            tlsSpoofingScore: 0.7 // NOUVEAU: Important pour les API
         },
         thresholds: { low: 25, medium: 50, high: 80, block: 95 },
         patterns: {
@@ -140,7 +143,8 @@ const securityProfiles = {
             behaviorScore: 0.5, // Less emphasis on complex interactions
             honeypotScore: 1.0, // Crucial for comment spam
             crossLayerInconsistencyScore: 0.4,
-            timeInconsistencyScore: 0.8
+            timeInconsistencyScore: 0.8,
+            tlsSpoofingScore: 0.6 // NOUVEAU: Moins critique pour les blogs
         },
         thresholds: { low: 25, medium: 55, high: 80, block: 95 },
         patterns: {
@@ -174,7 +178,8 @@ const securityProfiles = {
             behaviorScore: 0.8, // Important for checkout/login forms
             honeypotScore: 1.0,
             crossLayerInconsistencyScore: 0.7,
-            timeInconsistencyScore: 0.9
+            timeInconsistencyScore: 0.9,
+            tlsSpoofingScore: 0.9 // NOUVEAU: Très important pour l'e-commerce
         },
         thresholds: { low: 15, medium: 40, high: 70, block: 90 },
         patterns: {
@@ -231,48 +236,56 @@ const getPowSolverCode = () => {
 };
 
 /**
- * Calculates the JA3 fingerprint hash from the TLS Client Hello message.
- * JA3 is a more reliable way to identify client applications (e.g., a specific browser or a script)
- * based on the specifics of its TLS handshake.
+ * Extracts TLS fingerprints (JA3 and JA4) from request context.
+ * Prioritizes headers from reverse proxies (x-ja4-hash) and falls back to JA3 calculation
+ * from raw socket data if available.
  * @param {object} context - The request context, containing the raw request object.
- * @returns {string|null} The MD5 hash of the JA3 string, or null if it cannot be computed.
+ * @returns {{ja3: string|null, ja4: string|null}} An object containing JA3 and JA4 hashes.
  */
-function getJa3Hash(context) {
-    // 1. Prefer the JA3 hash from a trusted reverse proxy (e.g., Nginx, Cloudflare).
-    const ja3FromHeader = context.headers['x-ja3-hash'];
+function getTlsFingerprint(context) {
+    let ja3 = null;
+    let ja4 = null;
+
+    // 1. Prefer JA4 hash from a trusted reverse proxy header.
+    const ja4FromHeader = context.headers['x-ja4-hash'];
+    if (ja4FromHeader) {
+        ja4 = ja4FromHeader;
+    }
+    // 2. Prefer JA3 hash from a trusted reverse proxy header.
+    const ja3FromHeader = context.headers['x-ja3-hash']; // Assuming a proxy might provide JA3 too
     if (ja3FromHeader) {
-        return ja3FromHeader;
+        ja3 = ja3FromHeader;
     }
 
-    // 2. Fallback to calculating from the raw socket if available (requires Node.js to handle TLS).
+    // 3. Fallback to calculating from the raw socket if available and if headers were not present.
     const clientHello = context.rawReq?.socket?.clientHello;
-    if (!clientHello) {
-        return null;
-    }
-
-    try {
-        const { version, ciphers, extensions, ellipticCurves, ellipticCurvePointFormats } = clientHello;
+    if (clientHello && !ja3) { // Only calculate if ja3 is not already set
+        try {
+            const { version, ciphers, extensions, ellipticCurves, ellipticCurvePointFormats } = clientHello;
 
-        // The official JA3 spec includes the TLS version.
-        // Node.js provides it as a string like 'TLSv1.3', we need the corresponding decimal value.
-        const tlsVersionMap = {
-            'TLSv1': 769, 'TLSv1.1': 770, 'TLSv1.2': 771, 'TLSv1.3': 772
-        };
-        const tlsVersionId = tlsVersionMap[version] || 0;
-
-        const ja3String = [
-            tlsVersionId,
-            // The ciphers array from clientHello is an array of objects, not just IDs.
-            Array.isArray(ciphers) ? ciphers.join('-') : '',
-            extensions?.join('-') || '',
-            ellipticCurves?.join('-') || '',
-            ellipticCurvePointFormats?.join('-') || ''
-        ].join(',');
-
-        return crypto.createHash('md5').update(ja3String).digest('hex');
-    } catch (e) {
-        return null; // Could fail if clientHello structure is unexpected.
+            // The official JA3 spec includes the TLS version.
+            // Node.js provides it as a string like 'TLSv1.3', we need the corresponding decimal value.
+            const tlsVersionMap = {
+                'TLSv1': 769, 'TLSv1.1': 770, 'TLSv1.2': 771, 'TLSv1.3': 772
+            };
+            const tlsVersionId = tlsVersionMap[version] || 0;
+
+            const ja3String = [
+                tlsVersionId,
+                // The ciphers array from clientHello is an array of objects, not just IDs.
+                Array.isArray(ciphers) ? ciphers.join('-') : '',
+                extensions?.join('-') || '',
+                ellipticCurves?.join('-') || '',
+                ellipticCurvePointFormats?.join('-') || ''
+            ].join(',');
+
+            ja3 = crypto.createHash('md5').update(ja3String).digest('hex');
+        } catch (e) {
+            // Could fail if clientHello structure is unexpected.
+            ja3 = null;
+        }
     }
+    return { ja3, ja4 };
 }
 /**
  * Creates a stable hash based on device characteristics, independent of the IP.
@@ -304,7 +317,7 @@ export function getDeviceHash(context) {
     return getCompositeDeviceHash(context);
 }
 
-export function getCompositeDeviceHash(context) {
+function getCompositeDeviceHash(context) {
     const srv = new FingerprintBuilder();
 
     // Si un fingerprint client est fourni, on l'intègre comme un signal fort,
@@ -322,70 +335,95 @@ export function getCompositeDeviceHash(context) {
     // 1. SIGNAL FORT: User Agent (poids élevé)
     const ua = context.headers["user-agent"];
     if (ua) {
-        srv.add("ua", ua);
+        srv.add("ua", ua); // User-Agent
     }
 
-    // 2. SIGNAL FORT: JA3 TLS Fingerprint
-    const ja3 = getJa3Hash(context);
+    // 2. SIGNAUX DE BAS NIVEAU (Transport & Réseau) - Très fiables si fournis par un proxy
+    const { ja3, ja4 } = getTlsFingerprint(context);
     if (ja3) srv.add("ja3", ja3);
+    if (ja4) srv.add("ja4", ja4);
+
+    const h2Fingerprint = context.headers['x-http2-fingerprint'];
+    if (h2Fingerprint) srv.add("h2", h2Fingerprint);
+
+    const tcpFingerprint = context.headers['x-tcp-fingerprint'];
+    if (tcpFingerprint) srv.add("tcp", tcpFingerprint);
+
+    // 3. SIGNAUX DE HAUT NIVEAU (Applicatif) Moins fiables, mais utiles pour la corroboration
+    const headersToCapture = {
+        "ch_ua": "sec-ch-ua",
+        "ch_platform": "sec-ch-ua-platform",
+        "ch_mobile": "sec-ch-ua-mobile",
+        "ch_model": "sec-ch-ua-model",
+        "ch_arch": "sec-ch-ua-arch",
+        "ch_bitness": "sec-ch-ua-bitness",
+        "upgrade_req": "upgrade-insecure-requests",
+        "accept_lang": "accept-language",
+        "accept_enc": "accept-encoding",
+        "accept": "accept"
+    };
 
-    // 3. SIGNAL MOYEN: Client Hints (modern browsers)
-    if (context.headers["sec-ch-ua"]) {
-        srv.add("ch_ua", context.headers["sec-ch-ua"]);
-    }
-    if (context.headers["sec-ch-ua-platform"]) {
-        srv.add("ch_platform", context.headers["sec-ch-ua-platform"]);
-    }
-    if (context.headers["sec-ch-ua-mobile"]) {
-        srv.add("ch_mobile", context.headers["sec-ch-ua-mobile"]);
-    }
-    if (context.headers["sec-ch-ua-model"]) {
-        srv.add("ch_model", context.headers["sec-ch-ua-model"]);
-    }
-    if (context.headers["sec-ch-ua-arch"]) {
-        srv.add("ch_arch", context.headers["sec-ch-ua-arch"]);
-    }
-    if (context.headers["sec-ch-ua-bitness"]) {
-        srv.add("ch_bitness", context.headers["sec-ch-ua-bitness"]);
+    for (const [key, headerName] of Object.entries(headersToCapture)) {
+        const headerValue = context.headers[headerName];
+        if (headerValue) {
+            srv.add(key, headerValue);
+        }
     }
 
-    // 4. SIGNAL MOYEN: HTTP Version et protocole
+    // 4. SIGNAUX DE CONTEXTE (HTTP Version, Cookies)
     if (context.httpVersion) {
         srv.add("http_ver", context.httpVersion);
     }
-    if (context.headers["upgrade-insecure-requests"]) {
-        srv.add("upgrade", context.headers["upgrade-insecure-requests"]);
-    }
-
-    // 11. SIGNAL AVANCÉ: Cookies (si disponible)
     if (context.cookies) {
         const cookieKeys = Object.keys(context.cookies).sort().join(',');
-        srv.add("cookie_keys", cookieKeys);
-    }
-
-    // 12. SIGNAL AVANCÉ: Format de la requête
-    if (context.rawHeaders) {
-        // Vérifier des headers spécifiques qui indiquent le client
-        const clientHeaders = ['x-requested-with', 'x-forwarded-for', 'x-real-ip', 'cf-connecting-ip'];
-        clientHeaders.forEach(h => {
-            if (context.headers[h]) {
-                srv.add(h.replace(/-/g, '_'), context.headers[h]);
-            }
-        });
-    }
-
-    // 13. OPTIONNEL: IP (version simplifiée pour les réseaux partagés)
-    // Ne pas inclure l'IP complète, mais un hash du réseau /24 ou /16
-    // pour détecter les changements de réseau tout en protégeant la vie privée
-    const ip = context.clientIp || context.headers['x-forwarded-for']?.split(',')[0]?.trim();
-    if (ip && isPrivateIp(ip)) {
-        // Pour les IP privées, on peut prendre le /24
-        const networkHash = hashNetwork(ip, 24);
-        srv.add("network", networkHash);
+        if (cookieKeys) {
+            srv.add("cookie_keys", cookieKeys);
+        }
     }
 
     return srv.toString();
 }
+export { getCompositeDeviceHash };
+
+/**
+ * @private
+ * A knowledge base of known TLS (JA3) fingerprints for common browsers.
+ * This helps in detecting inconsistencies between the TLS layer and the HTTP User-Agent.
+ * The key is the JA3 hash, and the value is the browser family.
+ * This list is not exhaustive but covers many common cases.
+ */
+const tlsFingerprintDb = {
+    // --- Chrome (Desktop) ---
+    'e188a442b87f422c5a1e80b05399435b': 'Chrome', // Chrome 107, Windows 10
+    'd8e35855049321c6042a4325c697858f': 'Chrome', // Chrome 114, Windows 11
+    'a9f90958d44533748c139a5d1895b925': 'Chrome', // Chrome 116, macOS
+    '3b5379916d2b3882253c42885956a350': 'Chrome', // Chrome 124, Linux
+
+    // --- Chrome (Mobile) ---
+    '59822058c95c33d2d06e52f410855c8c': 'Chrome', // Chrome 120, Android 13
+
+    // --- Firefox (Desktop) ---
+    'b386946a5a586163c7c533636b45c355': 'Firefox', // Firefox 102, Windows 10
+    '66236495a523c1785f8f3a105b248b11': 'Firefox', // Firefox 115, Windows 11
+    'b73d470006575b5e35167a0b5a8540e2': 'Firefox', // Firefox 121, macOS
+    '8443d7562933834333943465d52363cf': 'Firefox', // Firefox 125, Linux
+
+    // --- Firefox (Mobile) ---
+    '02720628957d38c6111a18433abe833f': 'Firefox', // Firefox 125, Android 14
+
+    // --- Safari & iOS (Shared TLS Stack) ---
+    // On iOS, all browsers (Chrome, Firefox, etc.) must use WebKit, which uses Apple's TLS stack.
+    // Therefore, they all share the same JA3 fingerprint as Safari on that OS version.
+    'b633f21d532d35967c8753c38536b4d3': 'Safari', // Safari 16, macOS
+    '4d7a28d5f55b359b69100a311013f03e': ['Safari', 'Chrome', 'Firefox'], // Safari 17, iOS 17 (and other browsers on iOS 17)
+    '8dd3d7532873575314df23c447543001': ['Safari', 'Chrome', 'Firefox'], // Safari 17.4, iOS 17.4
+
+    // --- Common Libraries & Bots (for spoofing detection) ---
+    '47344a349b75c4e82333475553b5f358': 'Python', // Python 3.10 `requests` library
+    'b29587b8a143c42546133ad7704b3310': 'Go',     // Go 1.19 `http` library
+    'd435b5223b2884c5a832b842637e245f': 'Java',   // Java 11 `HttpClient`
+    'c72366b9551263d990b7fa574225332c': 'curl',   // curl 7.81.0
+};
 
 // Fonctions utilitaires
 function parseUserAgent(ua) {
@@ -522,7 +560,10 @@ export const verifyTspChallenge = (
   targetMaxDistance,
   cities,
 ) => {
-  try {
+    // Input validation: ensure the solution is a non-empty string before trying to parse it.
+    if (typeof solutionPathJson !== 'string' || solutionPathJson.length === 0) return false;
+
+    try {
     const solutionPath = JSON.parse(solutionPathJson);
     if (!Array.isArray(solutionPath) || solutionPath.length !== numCities)
       return false;
@@ -703,6 +744,13 @@ export const verifyPoWAndGenerateTicket = (
  * The server performs the same calculation to validate.
  */
 export const verifyMemoryPoW = (nonce, solution, difficulty = 16, clientSecret = '') => {
+  // Hard cap on memory difficulty to prevent DoS attacks from malicious clients
+  // submitting an arbitrarily large difficulty value.
+  const MAX_ALLOWED_MEM_DIFFICULTY = 128; // 128MB
+  if (difficulty > MAX_ALLOWED_MEM_DIFFICULTY) {
+    console.warn(`[Security] Memory PoW verification attempt with excessive difficulty: ${difficulty}MB. Denied.`);
+    return false;
+  }
   const size = difficulty * 1024 * 1024;
   const iterations = size / 16;
   const buffer = new Uint32Array(size / 4);
@@ -722,8 +770,9 @@ export const verifyMemoryPoW = (nonce, solution, difficulty = 16, clientSecret =
   return finalHash === parseInt(solution, 10);
 };
 export const isTicketValid = (ip, ticket) => {
-  if (!ticket) return false;
-  const [expiry, sig] = ticket.split(":");
+  // Input validation: ensure the ticket is a non-empty string with the correct format.
+  if (typeof ticket !== 'string' || !ticket.includes(':')) return false;
+  const [expiry, sig] = ticket.split(':');
   if (!expiry || !sig || Date.now() > parseInt(expiry, 10)) return false;
   const expectedSig = crypto
     .createHmac("sha256", getPowSecret())
@@ -895,6 +944,17 @@ function getBehaviorScore(context) {
       score += 40;
     }
 
+    // 3. (NOUVEAU) Analyse de la longueur de l'historique de navigation.
+    // Un historique court est suspect (nouvel onglet, bot), un historique long est un bon signe.
+    if (typeof metrics.historyLength === 'number') {
+        if (metrics.historyLength === 1) {
+            score += 15; // Légère pénalité pour un historique de session vierge.
+        } else if (metrics.historyLength >= 5) {
+            score -= 20; // Bonus : un historique long est un fort indicateur humain.
+        } else if (metrics.historyLength >= 2) {
+            score -= 10; // Petit bonus pour une navigation de base.
+        }
+    }
     // 3. Vérification de la plausibilité et de la distribution des métriques.
     // Un bot pourrait envoyer des valeurs aléatoires, mais elles ne suivront probablement pas
     // des distributions naturelles (comme la loi de Benford pour les premiers chiffres).
@@ -923,7 +983,7 @@ function getBehaviorScore(context) {
       if (keystrokeDeviation > 0.15) score += 40;
     }
 
-    return { behaviorScore: Math.min(100, score) };
+    return { behaviorScore: Math.max(0, Math.min(100, score)) }; // Assure que le score reste entre 0 et 100
   } catch (e) {
     return { behaviorScore: 10 }; // En-tête malformé = légèrement suspect.
   }
@@ -1007,6 +1067,56 @@ function getCrossLayerInconsistency(context) {
     }
 }
 
+/**
+ * Calcule un score d'incohérence entre les données du fingerprint TLS (JA3/JA4) et les en-têtes serveur (User-Agent).
+ * Cela permet de détecter le spoofing de fingerprint TLS.
+ * @param {object} context - Le contexte de la requête.
+ * @returns {{tlsSpoofingScore: number}}
+ */
+function getTlsSpoofingScore(context, getTlsFingerprintFn = getTlsFingerprint) {
+    const { ja3, ja4 } = getTlsFingerprintFn(context) || { ja3: null, ja4: null }; // Defensive check
+    const ua = context.headers["user-agent"] || '';
+
+    // 1. Penalize if a TLS fingerprint is present but the User-Agent is generic or missing.
+    // This is a strong indicator of a non-browser client trying to look legitimate.
+    if ((ja3 || ja4) && (!ua || ua.length < 10 || ua.toLowerCase().includes('python') || ua.toLowerCase().includes('curl'))) {
+        return { tlsSpoofingScore: 50 };
+    }
+
+    // 2. If no JA3 hash is available, we cannot perform the consistency check.
+    if (ja3 && ua) {
+        // Look up the expected browser family (or families) from our database.
+        let expectedBrowsers = tlsFingerprintDb[ja3];
+
+        if (expectedBrowsers) {
+            // Ensure it's always an array for consistent logic.
+            if (!Array.isArray(expectedBrowsers)) {
+                expectedBrowsers = [expectedBrowsers];
+            }
+
+            // Parse the User-Agent to get the claimed browser.
+            const { browser: claimedBrowser } = parseUserAgent(ua);
+
+            // Check if the claimed browser is one of the legitimate possibilities for this JA3 hash.
+            // We use `some` to see if the claimed browser starts with any of the expected browser names.
+            // (e.g., "Chrome/116" starts with "Chrome").
+            const isMatch = expectedBrowsers.some(expected => claimedBrowser?.startsWith(expected));
+
+            if (claimedBrowser && !isMatch) {
+                return { tlsSpoofingScore: 80 }; // High score for a clear mismatch.
+            }
+        }
+    }
+
+    // If we reach here, either:
+    // - No JA3 was available.
+    // - The JA3 was not in our database (we can't make a decision).
+    // - The JA3 and User-Agent were consistent.
+    // In all these cases, the score is 0.
+    return { tlsSpoofingScore: 0 };
+}
+
+
 /**
  * Calcule un score basé sur la détection explicite de frameworks d'automatisation.
  * @param {object} context - Le contexte de la requête.
@@ -1365,6 +1475,9 @@ export const getSuspicionVector = async (context, securityConfig) => {
   // On appelle getHoneypotScore ici pour que son résultat soit inclus dans le vecteur.
   const { honeypotScore } = getHoneypotScore(context, honeypotConfig);
 
+  // NOUVEAU: On calcule le score de spoofing TLS.
+  const { tlsSpoofingScore } = getTlsSpoofingScore(context);
+
   // NOUVEAU: On appelle getBotScore pour détecter les marqueurs d'automatisation.
   const { botScore } = getBotScore(context);
 
@@ -1386,7 +1499,7 @@ export const getSuspicionVector = async (context, securityConfig) => {
       deviceData.ips = new Set(deviceData.ips);
   }
   // Le vecteur de suspicion est maintenant complet.
-  return { ...behavioral, headerAnomalyScore, inconsistencyScore, behaviorScore, honeypotScore, botScore, requestPatternScore, crossLayerInconsistencyScore, timeInconsistencyScore };
+  return { ...behavioral, headerAnomalyScore, inconsistencyScore, behaviorScore, honeypotScore, botScore, requestPatternScore, crossLayerInconsistencyScore, timeInconsistencyScore, tlsSpoofingScore };
 };
 
 // A residential user can change networks (home, 4G, public wifi).
@@ -1687,9 +1800,45 @@ export class FingerprintEngine {
     this.securityConfig = securityConfig;
     this.isProduction = isProduction;
     this._allowlist = this._buildAllowlist();
+    this._validateConfig(securityConfig); // Validate the configuration
     this.verbose = securityConfig.verbose || false;
   }
 
+  /**
+   * Validates the security configuration object to detect potential typos or missing essential keys.
+   * @private
+   * @param {object} config - The security configuration object.
+   */
+  _validateConfig(config) {
+    if (!config) {
+      console.warn('[Fingerprint] Warning: No securityConfig provided. Using default behaviors, which may not be secure.');
+      return;
+    }
+
+    const knownKeys = new Set([
+      'weights', 'thresholds', 'cpu', 'ticketMaxAge', 'challengeTtl',
+      'deviceIdCookieMaxAge', 'challengePagePath', 'verbose', 'patterns',
+      'honeypot', 'whitelist', 'isStaticResource', 'isApiRequest', 'logger',
+      'autotuning', 'enableUsefulWork', 'usefulWorkConfigPath', 'challengeNewDevices',
+      'similarityThreshold'
+    ]);
+
+    // 1. Check for essential keys
+    if (!config.weights) {
+      console.warn('[Fingerprint] Warning: `securityConfig.weights` is not defined. Suspicion scores will be 0.');
+    }
+    if (!config.thresholds) {
+      console.warn('[Fingerprint] Warning: `securityConfig.thresholds` is not defined. Challenges may not be issued correctly.');
+    }
+
+    // 2. Check for unknown (potentially misspelled) keys
+    for (const key in config) {
+      if (!knownKeys.has(key)) {
+        console.warn(`[Fingerprint] Warning: Unknown key '${key}' found in securityConfig. This might be a typo.`);
+      }
+    }
+  }
+
   _log(message, data = {}) {
     if (this.verbose) {
       console.log(`[FingerprintEngine] ${message}`, data);
@@ -1709,6 +1858,7 @@ export class FingerprintEngine {
             (suspicionVector.behaviorScore || 0) * (weights.behaviorScore || 0) +
             (suspicionVector.botScore || 0) * (weights.botScore || 0) + // Ajout du nouveau score
             (suspicionVector.crossLayerInconsistencyScore || 0) * (weights.crossLayerInconsistencyScore || 0) +
+            (suspicionVector.tlsSpoofingScore || 0) * (weights.tlsSpoofingScore || 0) + // NOUVEAU: TLS Spoofing
             (suspicionVector.timeInconsistencyScore || 0) * (weights.timeInconsistencyScore || 0);
 
         return Math.min(100, score);
@@ -2094,7 +2244,7 @@ export class FingerprintEngine {
         // We compare the fingerprint of the request that triggered the challenge
         // with the fingerprint of the request that is submitting the solution.
         // They should be very similar.
-        similarity = FingerprintBuilder.compare(originalFingerprint, getCompositeDeviceHash(requestContext));
+        similarity = FingerprintBuilder.compare(originalFingerprint, solverFingerprint);
             }
 
             if (similarity < similarityThreshold) {
@@ -2128,6 +2278,15 @@ export class FingerprintEngine {
             }
         } else {
             this._log('Challenge context not found or expired', { pow_nonce });
+            // --- NOUVELLE MESURE DE SÉCURITÉ ---
+            // Si un client soumet un nonce invalide ou expiré, c'est une tentative de probing.
+            // On applique une pénalité maximale pour bloquer ou re-challenger lourdement.
+            suspicionVector.honeypotScore = 100;
+            finalScore = this.calculateFinalScore(suspicionVector);
+            this._log('Invalid nonce submitted (probing attempt) - applying max penalty', { newFinalScore: finalScore });
+            // La logique continue vers la section `if (isValid)` qui échouera,
+            // puis le score élevé sera utilisé pour bloquer ou re-challenger.
+            isValid = false; // On s'assure que la validation échoue.
         }
         if (isValid) {
             // La solution est valide. On supprime le secret et on redirige.
@@ -2225,7 +2384,7 @@ export class FingerprintEngine {
         if (challengeContext) {
             try {
                 const workResult = JSON.parse(pow_solution_work_result);
-                problemManager.integrateSolution(pow_problem_id, workResult);
+                getProblemManager(this.securityConfig.usefulWorkConfigPath).integrateSolution(pow_problem_id, workResult);
 
                 await store.delete(`secret:${pow_nonce}`);
                 // Accorder un ticket de passage comme pour un PoW normal
@@ -2305,10 +2464,13 @@ export class FingerprintEngine {
 
         // Pour les scores élevés, on choisit aléatoirement entre un challenge de travail utile et un PoW classique.
         // Cela rend l'automatisation plus difficile pour un attaquant.
-        if (isSuspicious && this.securityConfig.enableUsefulWork && Math.random() > 0.5) {
+        // Utilisation de crypto pour un choix plus sécurisé.
+        const shouldUseUsefulWork = this.securityConfig.enableUsefulWork && crypto.randomBytes(1).readUInt8(0) / 255 > 0.5;
+
+        if (isSuspicious && shouldUseUsefulWork) {
             this._log('Issuing a useful work challenge', { finalScore });
 
-            const { problemId, task } = problemManager.dispatchWork(suspicionFactor);
+            const { problemId, task } = getProblemManager(this.securityConfig.usefulWorkConfigPath).dispatchWork(suspicionFactor);
 
             await store.set(`secret:${nonce}`, { clientSecret, originalPath: path }, 300);
 
@@ -2611,6 +2773,7 @@ export const xss_analyzer = async (data) => {
  */
 export const modsecurity_analyzer = (rulesPath) => {
     let wafInstance = null; // Singleton instance for the WAF
+    let isModSecurityAvailable = true; // Flag specific to this analyzer instance
 
     return async (data) => {
         if (!rulesPath) {
@@ -2618,8 +2781,12 @@ export const modsecurity_analyzer = (rulesPath) => {
             return false;
         }
 
+        if (!isModSecurityAvailable) {
+            return false; // Skip if the module is known to be unavailable
+        }
+
         try {
-            if (!wafInstance) {
+            if (!wafInstance && isModSecurityAvailable) {
                 // Dynamically import the library only when needed.
                 const { ModSecurity } = await import('modsecurity-nodejs');
                 wafInstance = new ModSecurity();
@@ -2634,7 +2801,8 @@ export const modsecurity_analyzer = (rulesPath) => {
             return result !== null; // A non-null result means a threat was detected.
         } catch (error) {
             if (error.code === 'ERR_MODULE_NOT_FOUND') {
-                console.warn('[Fingerprint] Warning: "modsecurity-nodejs" is not installed. The WAF analyzer is disabled. Run "npm install modsecurity-nodejs" to enable it.');
+                console.warn('[Fingerprint] Warning: "modsecurity-nodejs" is not installed. The WAF analyzer is now disabled. Run "npm install modsecurity-nodejs" to enable it.');
+                isModSecurityAvailable = false; // Disable for future calls
             }
             return false; // Assume data is safe if any error occurs.
         }
@@ -2749,6 +2917,11 @@ export const default_whitelist = () => [
 export const powMiddleware = (securityConfig) => {
   const engine = new FingerprintEngine(securityConfig);
 
+  // Initialize the problem manager with the configured path, if provided.
+  if (securityConfig.enableUsefulWork && securityConfig.usefulWorkConfigPath) {
+    getProblemManager(securityConfig.usefulWorkConfigPath, store); // This correctly initializes the singleton
+  }
+
   if (securityConfig.autotuning) {
     startThresholdAutoTuning({
       securityConfig: securityConfig,
@@ -2837,8 +3010,11 @@ export const __internal = {
     getCrossLayerInconsistency, // Expose for testing
     // Expose page generators for security testing
     getTimeInconsistencyScore,
+    getTlsFingerprint, // NOUVEAU: Expose pour les tests
+    getTlsSpoofingScore, // NOUVEAU: Expose pour les tests
     generateCpuTargetChallengePage,
     generateCombinedPoWChallengePage,
+    problemManager, // Re-export the problemManager promise
 };
 
 // --- THRESHOLD AUTO-TUNING SECTION ---
@@ -2854,8 +3030,16 @@ let autoTuningJobId = null;
  * @param {number} maxDataPoints - The maximum number of data points to keep after an optimization cycle.
  */
 function runThresholdOptimization(securityConfig, trafficData, minDataPoints, maxDataPoints) {
-  if (trafficData.length < minDataPoints) {
+  const highConfidenceLogs = trafficData.filter(log => log.type === 'challenge_solved' || log.type === 'trap_triggered').length;
+  const highConfidenceRatio = trafficData.length > 0 ? highConfidenceLogs / trafficData.length : 0;
+  const MIN_CONFIDENCE_RATIO = 0.05; // Exiger au moins 5% de signaux forts.
+
+  if (trafficData.length < minDataPoints || highConfidenceRatio < MIN_CONFIDENCE_RATIO) {
+    if (trafficData.length < minDataPoints) {
     console.log(`[AutoTuning] Reporté : ${trafficData.length}/${minDataPoints} points de données.`);
+    } else {
+      console.log(`[AutoTuning] Reporté : Ratio de confiance insuffisant (${(highConfidenceRatio * 100).toFixed(2)}% < ${(MIN_CONFIDENCE_RATIO * 100).toFixed(2)}%).`);
+    }
     return;
   }
 
@@ -2886,23 +3070,43 @@ function runThresholdOptimization(securityConfig, trafficData, minDataPoints, ma
     }
   }
 
-  // Appliquer la nouvelle configuration optimisée
+  // --- NOUVEAU : Logique d'inertie pour l'application de la configuration ---
+  // Au lieu d'appliquer directement la nouvelle configuration, on fait "glisser"
+  // l'ancienne vers la nouvelle, avec une vélocité de changement maximale.
   const newConfig = bestSolution.solution;
+  const MAX_CHANGE_VELOCITY = 0.15; // 15% de changement maximum par cycle
 
-  // S'assurer que les objets de configuration existent avant d'utiliser Object.assign
-  if (!securityConfig.thresholds) securityConfig.thresholds = {};
-  if (!securityConfig.weights) securityConfig.weights = {};
-  if (!securityConfig.patterns) securityConfig.patterns = {};
+  /**
+   * Met à jour un objet de configuration (ex: thresholds, weights) en douceur.
+   * @param {object} currentConfig - La configuration actuelle à modifier.
+   * @param {object} targetConfig - La configuration cible proposée par l'optimiseur.
+   */
+  const applyInertialUpdate = (currentConfig, targetConfig) => {
+      if (!currentConfig || !targetConfig) return; // Vérifier aussi currentConfig
+      for (const key in targetConfig) {
+          if (Object.hasOwnProperty.call(currentConfig, key)) {
+              const currentValue = currentConfig[key];
+              const targetValue = targetConfig[key];
+              const delta = targetValue - currentValue;
+              const maxChange = Math.abs(currentValue * MAX_CHANGE_VELOCITY);
+
+              // Limite le changement à la vélocité maximale
+              const change = Math.max(-maxChange, Math.min(maxChange, delta));
+              
+              currentConfig[key] += change;
+          }
+      }
+  };
 
-  Object.assign(securityConfig.thresholds, newConfig.thresholds || {});
-  Object.assign(securityConfig.weights, newConfig.weights || {});
-  Object.assign(securityConfig.patterns, newConfig.patterns || {});
+  applyInertialUpdate(securityConfig.thresholds, newConfig.thresholds);
+  applyInertialUpdate(securityConfig.weights, newConfig.weights);
+  applyInertialUpdate(securityConfig.patterns, newConfig.patterns);
 
   console.log("[AutoTuning] Nouvelle configuration de sécurité optimisée appliquée.");
   console.log("[AutoTuning] Objectifs atteints :", { falsePositiveRate: bestSolution.objectives[0].toFixed(4), falseNegativeRate: bestSolution.objectives[1].toFixed(4) });
-  console.log("[AutoTuning] Seuils :", securityConfig.thresholds);
-  console.log("[AutoTuning] Poids :", securityConfig.weights);
-  console.log("[AutoTuning] Patterns :", securityConfig.patterns);
+  console.log("[AutoTuning] Nouveaux seuils :", securityConfig.thresholds);
+  console.log("[AutoTuning] Nouveaux poids :", securityConfig.weights);
+  console.log("[AutoTuning] Nouveaux patterns :", securityConfig.patterns);
 }
 
 /**